Absolutely yes! Ranger policies have several settings to maintain administrative control over what is and is not scanned. A few examples…. You can set a minimum number of Sentinel agents that must be on a subnet before the system event considers it as a possibility. If you set the number at, say 5, small home networks and coffee shops are unlikely to be scanned because you probably will never have 5 work computers on those networks at any one time. Further, administrators can require an explicit “yes, scan this network” from within the SentinelOne Singularity console to further control what is analyzed.

Rogues and Ranger are both built into the agent. The capabilities differ based on the purchased license level. Rogues is a free feature included in the Singularity Complete and Singularity Control product bundles and informs administrators which devices on the network still require a Sentinel agent. Ranger is a full featured add-on product with multiple added network visibility and control capabilities that report on all IP-enabled device types.

We understand this concern and have built in per-network policy controls so that you can use every type of scan technique on some networks but then selectively use only certain network learning methods on others. For example, you can turn off active scan probes altogether and just rely on passive network listening on an OT network. Or, you might use passive listening plus ICMP and SNMP active scanning probes but NOT use TCP connect scans because you are worried about destabilizing certain types of control units that use IP and the SCADA protocol. These are just examples. The point is, administrators can mix and match a wide variety of scanning and passive listening techniques on a per network basis to discover what is connected where and how it is communicating.

Yes! Ranger will build out an asset inventory for every scanned network and let you export the data.

When an administrator chooses to block a device, that device is effectively isolated from all SentinelOne managed Windows, Mac, and Linux hosts. This is accomplished using local network control firewall rules as enforced by the Sentinel agent on those devices. SentinelOne continues to build out the Ranger instrumentation to provide additional network access controls in the future.

Ranger combines capabilities with Deep Visibility ActiveEDR and our Storyline Active Response Engine (STAR) to alert you when a new device without a Sentinel agent has connected to the networks of your choice. You may then take the response of your choosing including block communications from the unknown device.